Wireless communications

ABSTRACT

Integrity protection is activated for user plane data transferred between a network node and a terminal device of the cellular communications network. The activation can be initiated by the terminal device sending a request message to a second network node. Thus, a UE, such as a Cellular IoT UE, and a network node such as a SGSN are able to use LLC layer integrity protection for both control plane and user plane data.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.15/772,760, filed on May 1, 2018, which is the National Stage ofInternational Patent Application No. PCT/EP2016/076408, filed Nov. 2,2016, which claims priority to U.S. provisional application No.62/249,538, filed on Nov. 2, 2015. The above identified applications areincorporated by this reference.

TECHNICAL FIELD

This invention relates to a method of operation of a terminal device andone or more network nodes in a cellular communications network.

BACKGROUND

The Cellular Internet of Things (CIoT) is a new radio technology that isable to provide extended coverage for harsh environments, for example,basements, and is designed to serve massive number of UEs (over 50,000per base station) using a very limited bandwidth (e.g. 160 bps).

The current assumption in 3GPP standardization is that the securitymechanism for CIoT over GSM EDGE Radio Access Network (GERAN) would bebased on enhancements of General Packet Radio Service (GPRS) security asintroducing integrity protection for the control plane in Gb modebetween the CIoT user equipment and the Serving GPRS Support Node(SGSN).

The assumption for CIoT is that the Universal Mobile TelecommunicationsSystem (UMTS) Authentication and Key Agreement (AKA) is run at the GPRSMobility Management and Session Management (GMM/SM) layer creating thekeying material, and the integrity protection is done at the LogicalLink Control (LLC) layer using the integrity key (IK′) created with thekey derivation function from the UMTS AKA session keys.

SUMMARY

According to the present invention there is provided a method ofoperation of a terminal device in a cellular communications network. Themethod comprises:

activating integrity protection for user plane data transferred betweenthe terminal device and a first network node of the cellularcommunications network.

The method may comprise, before activating integrity protection for theuser plane data: sending a request message from the terminal device to asecond network node, wherein the request message also indicates theability of the terminal device to use integrity protection for userplane data. In that case, the request message may also specify at leastone algorithm that the terminal device is capable of using for integrityprotection of user plane data.

The message may be a GMM Attach Request message, a EMM Attach Requestmessage, a GMM Routing Area Update Request message, or a EMM TrackingArea Update Request message.

The request message may further indicate whether or not the terminaldevice wishes to use integrity protection for user plane data.

The method may comprise activating integrity protection for the userplane data in response to receiving a return message from the secondnetwork node, the return message specifying that integrity protection isto be used for the user plane data.

The method may comprise activating integrity protection for the userplane data in the LLC layer, in response to an activation message fromthe GMM layer.

The method may comprise activating integrity protection for the userplane data in the PDCP layer, in response to an activation message fromthe RRC layer.

The method may comprise activating integrity protection for the userplane data in the RLC or MAC layer, in response to an activation messagefrom the GMM layer.

Where the method comprises activating integrity protection for the userplane data in the LLC layer, in response to an activation message fromthe GMM layer, the activation message from the GMM layer to the LLClayer may specify an integrity key and an integrity algorithm to beused.

Where the method comprises activating integrity protection for the userplane data in the PDCP layer, in response to an activation message fromthe RRC layer, the activation message from the RRC layer to the PDCPlayer may specify an integrity key and an integrity algorithm to beused.

Where the method comprises activating integrity protection for the userplane data in the RLC or MAC layer, in response to an activation messagefrom the GMM layer, the activation message from the GMM layer to the RLCor MAC layer may specify an integrity key and an integrity algorithm tobe used.

The method may then comprise deriving said integrity key by running UMTSAKA on the USIM.

The integrity algorithm to be used may be specified in a messagereceived from the second network node.

The first and second network nodes may be combined in an SGSN, or in aneNB, or in a Node-B or RNC, or the first network node may be a UPPE andthe second network node an ASME.

The entity taking the role of UPPE may be a 3G Node-B, or a 3G RNC.

The method may comprise using null encryption for the user plane data.

According to the present invention there is provided a method ofoperation of a network node in a cellular communications network. Themethod comprises: activating integrity protection for user plane datatransferred between the network node and a terminal device of thecellular communications network.

The method may comprise, before activating integrity protection for theuser plane data: receiving a request message from the terminal device,wherein the request message also indicates the ability of the terminaldevice to use integrity protection for user plane data. In that case,the request message may also specify at least one algorithm that theterminal device is capable of using for integrity protection of userplane data.

The message may be a GMM Attach Request message, a EMM Attach Requestmessage, a GMM Routing Area Update Request message, or a EMM TrackingArea Update Request message.

The request message may further indicate whether or not the terminaldevice wishes to use integrity protection for user plane data.

The method may comprise activating integrity protection for the userplane data after sending a return message to the terminal device, thereturn message specifying that integrity protection is to be used forthe user plane data. The return message to the terminal device mayspecify an integrity key and an integrity algorithm to be used.

The method may comprise activating integrity protection for the userplane data in the LLC layer, in response to an activation message fromthe GMM layer.

The method may comprise activating integrity protection for the userplane data in the PDCP layer, in response to an activation message fromthe RRC layer.

The method may comprise activating integrity protection for the userplane data in the RLC or MAC layer, in response to an activation messagefrom the GMM layer.

Where the method comprises activating integrity protection for the userplane data in the LLC layer, in response to an activation message fromthe GMM layer, the activation message from the GMM layer to the LLClayer may specify an integrity key and an integrity algorithm to beused.

Where the method comprises activating integrity protection for the userplane data in the PDCP layer, in response to an activation message fromthe RRC layer, the activation message from the RRC layer to the PDCPlayer may specify an integrity key and an integrity algorithm to beused.

Where the method comprises activating integrity protection for the userplane data in the RLC or MAC layer, in response to an activation messagefrom the GMM layer, the activation message from the GMM layer to the RLCor MAC layer may specify an integrity key and an integrity algorithm tobe used.

The integrity key and integrity algorithm specified in the activationmessage may be the same as the integrity key and integrity algorithmspecified in the return message.

The method may comprise deriving said integrity key before specifying itin the return message or the activation message.

The method may comprise determining the integrity algorithm to be usedbased on a message received from the terminal device specifying at leastone algorithm that the terminal device is capable of using for integrityprotection of user plane data.

The method may comprise activating integrity protection for user planedata transferred between the network node and a terminal device of thecellular communications network in response to receiving a message froma further network node indicating the wish of the further network nodeto use integrity protection for said user plane data. The furthernetwork node may be a HSS, or a SCEF.

The network node may be a SGSN, an eNB, Node-B or an RNC.

The method may comprise using null encryption for the user plane data.

According to the present invention there is provided a method ofoperation of a first network node in a cellular communications network.The method comprises: activating integrity protection for user planedata transferred between the first network node and a terminal device ofthe cellular communications network.

The method may comprise activating integrity protection for the userplane data in response to receiving a message from a second networknode, said message specifying that integrity protection is to be usedfor the user plane data.

The message from the second network node may specify an integrity key tobe used for said integrity protection, and/or an integrity algorithm tobe used for said integrity protection.

The method may further comprise, before activating said integrityprotection, negotiating with the terminal device an integrity algorithmto be used for said integrity protection.

The method may comprise activating integrity protection for the userplane data in the LLC layer.

The first network node may be a UPPE, or a 3G Node-B, or a 3G RNC, or aGGSN, or a P-GW, or an eNB, or a S-GW.

The second network node may be an ASME.

The method may comprise using null encryption for the user plane data.

According to the present invention there is provided a method ofoperation of a second network node in a cellular communications network.The method comprises: activating integrity protection for user planedata transferred between a first network node and a terminal device ofthe cellular communications network.

The method may comprise, before activating integrity protection for theuser plane data: receiving a request message from the terminal device,wherein the request message also indicates the ability of the terminaldevice to use integrity protection for user plane data.

The request message may also specify at least one algorithm that theterminal device is capable of using for integrity protection of userplane data.

The message may be a GMM Attach Request message, or a GMM Routing AreaUpdate Request message.

The request message may further indicate whether or not the terminaldevice wishes to use integrity protection for user plane data.

The method may comprise activating integrity protection for the userplane data after sending a return message to the terminal device, thereturn message specifying that integrity protection is to be used forthe user plane data. The return message to the terminal device may thenspecify an integrity key to be used, and/or an integrity algorithm to beused.

The method may comprise activating integrity protection for the userplane data by sending a message to the first network node. The messageto the first network node may specify an integrity key to be used,and/or may specify an integrity algorithm to be used.

The method may comprise deriving said integrity key before specifying itin the return message or said message to the first network node.

The method may comprise determining the integrity algorithm to be usedbased on a message received from the terminal device specifying at leastone algorithm that the terminal device is capable of using for integrityprotection of user plane data.

The method may further comprise activating integrity protection for userplane data transferred between the network node and a terminal device ofthe cellular communications network in response to receiving a messagefrom a further network node indicating the wish of the further networknode to use integrity protection for said user plane data. The furthernetwork node may be a HSS, or a SCEF.

The second network node may be an ASME.

The first network node may be a UPPE, or a 3G Node-B, or a 3G RNC, or aGGSN, or a P-GW, or an eNB, or a S-GW.

According to other aspects of the present invention, there are providedterminal devices and network nodes configured to operate in accordancewith these aspects.

According to other aspects of the present invention, there are providedcomputer programs and computer program products containing instructionsfor causing devices to operate in accordance with these aspects.

Thus, a UE, such as a Cellular IoT UE, and a network node such as a SGSNare able to use LLC layer integrity protection for both control planeand user plane data. Use of integrity protection for user data can benegotiated. The network node may wish to use user data integrityprotection if null-encryption is used. It can also be used e.g. if theCIoT UE has limited security capabilities, or if the HN wishes so.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a part of a cellular communications network.

FIG. 2 illustrates a terminal device in the network of FIG. 1.

FIG. 3 illustrates a network node in the network of FIG. 1.

FIG. 4 illustrates protocols in use in the network of FIG. 1.

FIG. 5 is a signalling diagram.

FIG. 6 is a signalling diagram.

FIG. 7 is a signalling diagram.

FIG. 8 is a signalling diagram.

FIG. 9 illustrates a terminal device in the network of FIG. 1.

FIG. 10 illustrates a network node in the network of FIG. 1.

FIG. 11 illustrates a first network node in a cellular communicationsnetwork.

FIG. 12 illustrates a second network node in the network of FIG. 1.

FIG. 13 is a flow chart, illustrating a method of operation of aterminal device in a cellular communications network.

FIG. 14 is a flow chart, illustrating a method of operation of a networknode in a cellular communications network.

FIG. 15 is a flow chart, illustrating a method of operation of a firstnetwork node in a cellular communications network.

FIG. 16 is a flow chart, illustrating a method of operation of a secondnetwork node in a cellular communications network.

DETAILED DESCRIPTION

The following sets forth specific details, such as particularembodiments for purposes of explanation and not limitation. But it willbe appreciated by one skilled in the art that other embodiments may beemployed apart from these specific details. In some instances, detaileddescriptions of well-known methods, nodes, interfaces, circuits, anddevices are omitted so as not obscure the description with unnecessarydetail. Those skilled in the art will appreciate that the functionsdescribed may be implemented in one or more nodes using hardwarecircuitry (e.g., analog and/or discrete logic gates interconnected toperform a specialized function, ASICs, PLAs, etc.) and/or using softwareprograms and data in conjunction with one or more digitalmicroprocessors or general purpose computers that are specially adaptedto carry out the processing disclosed herein, based on the execution ofsuch programs. Nodes that communicate using the air interface also havesuitable radio communications circuitry. Moreover, the technology canadditionally be considered to be embodied entirely within any form ofcomputer-readable memory, such as solid-state memory, magnetic disk, oroptical disk containing an appropriate set of computer instructions thatwould cause a processor to carry out the techniques described herein.

Hardware implementation may include or encompass, without limitation,digital signal processor (DSP) hardware, a reduced instruction setprocessor, hardware (e.g., digital or analog) circuitry including butnot limited to application specific integrated circuit(s) (ASIC) and/orfield programmable gate array(s) (FPGA(s)), and (where appropriate)state machines capable of performing such functions.

In terms of computer implementation, a computer is generally understoodto comprise one or more processors, one or more processing modules orone or more controllers, and the terms computer, processor, processingmodule and controller may be employed interchangeably. When provided bya computer, processor, or controller, the functions may be provided by asingle dedicated computer or processor or controller, by a single sharedcomputer or processor or controller, or by a plurality of individualcomputers or processors or controllers, some of which may be shared ordistributed. Moreover, the term “processor” or “controller” also refersto other hardware capable of performing such functions and/or executingsoftware, such as the example hardware recited above.

Although the description is given for user equipment (UE), it should beunderstood by the skilled in the art that “UE” is a non-limiting termcomprising any mobile or wireless device or node equipped with a radiointerface allowing for at least one of: transmitting signals in uplink(UL) and receiving and/or measuring signals in downlink (DL). A UEherein may comprise a UE (in its general sense) capable of operating orat least performing measurements in one or more frequencies, carrierfrequencies, component carriers or frequency bands. It may be a “UE”operating in single- or multi-radio access technology (RAT) ormulti-standard mode. As well as “UE”, the terms “mobile device” and“terminal device” may be used interchangeably in the followingdescription, and it will be appreciated that such a device does notnecessarily have to be ‘mobile’ in the sense that it is carried by auser. Instead, the term “mobile device” encompasses any device that iscapable of communicating with communication networks that operateaccording to one or more mobile communication standards, such as theGlobal System for Mobile communications, GSM, UMTS, Long-Term Evolution,LTE, etc.

A cell is associated with a base station, where a base station comprisesin a general sense any network node transmitting radio signals in thedownlink (DL) and/or receiving radio signals in the uplink (UL). Someexample base stations, or terms used for describing base stations, areeNodeB, eNB, NodeB, macro/micro/pico/femto radio base station, homeeNodeB (also known as femto base station), relay, repeater, sensor,transmitting-only radio nodes or receiving-only radio nodes, or WLANaccess point (AP). A base station may operate or at least performmeasurements in one or more frequencies, carrier frequencies orfrequency bands and may be capable of carrier aggregation. It may alsobe a single-radio access technology (RAT), multi-RAT, or multi-standardnode, e.g., using the same or different base band modules for differentRATs.

FIG. 1 illustrates a part of a network 10. The network 10 comprises abasestation 12 connected to a Cellular Internet of Things (CIoT)terminal device (UE) 20 and a Serving GPRS Support Node (SGSN) 30. Ofcourse, a network will typically include many basestations, and a verylarge number of terminal devices, but the present FIG. 1 is sufficientfor an understanding of the present invention. The terminal device maybe a user equipment device or may be a device that connectsautomatically to the network as required, and may be fixed or portable.

FIG. 2 shows a terminal device (UE) 20 that can be adapted or configuredto operate according to one or more of the non-limiting exampleembodiments described. The UE 20 comprises a processor or processingunit 22 that controls the operation of the UE 20. The processing unit 22is connected to a transceiver unit 24 (which comprises a receiver and atransmitter) with associated antenna(s) 26 which are used to transmitsignals to and receive signals from a base station 12 in the network 10.The UE 20 also comprises a memory or memory unit 28 that is connected tothe processing unit 22 and that contains instructions or computer codeexecutable by the processing unit 22 and other information or datarequired for the operation of the UE 20. Specifically, the memory ormemory unit 28 may contain instructions executable by said processingunit 22, whereby said terminal device is operative to activate integrityprotection of user plane data transferred between the terminal deviceand a first network node of the cellular communications network.

Embodiments are described below, in which the terminal device is aCellular Internet of Things UE. The same methods can be used by otherUEs than Cellular IoT UEs.

FIG. 3 shows a network node (which in this illustrated embodiment is aServing GPRS Support Node (SGSN)) 30 that can be adapted or configuredto operate according to one or more of the non-limiting exampleembodiments described. The SGSN 30 comprises a processor or processingunit 32 that controls the operation of the SGSN 30. The processing unit32 is connected to a transceiver unit 34 (which comprises a receiver anda transmitter) with associated antenna(s) 36 which are used to transmitsignals to and receive signals from terminal device(s) 20, viabasestations 12 in the network 10. The SGSN 30 also comprises a memoryor memory unit 38 that is connected to the processing unit 32 and thatcontains instructions or computer code executable by the processing unit32 and other information or data required for the operation of the SGSN30. Specifically, the memory or memory unit 38 contains instructionsexecutable by the processing unit 32, whereby said network node isoperative to activate integrity protection for user plane datatransferred between the network node and a terminal device of thecellular communications network. In other embodiments, the network nodehaving essentially the same structure as shown in FIG. 3 might take theform of an eNB, a Node-B or Radio Network Controller (RNC), or a UPPE,which may then be a 3G Node-B, a 3G RNC, a Gateway GPRS Support Node(GGSN), a PDN Gateway (P-GW), or a Serving Gateway (S-GW).

FIG. 4 illustrates a protocol layer control plane in Gb mode.

As can be seen from this figure, the Universal Mobile TelecommunicationsSystem (UMTS) Authentication and Key Agreement (AKA) is run at the GPRSMobility Management and Session Management (GMM/SM) layer creating thekeying material (CK, IK). The integrity protection is done at theLogical Link Control (LLC) layer using the integrity key (IK′) createdwith the key derivation function from the UMTS AKA session keys.

The security feature of integrity protection was never standardized in2G GPRS. This is a feature which could be introduced in Cellular IoTover GERAN. Integrity protection could be supported by the LLC layer inorder to be able to protect layer 3 control signalling messages as GMMmessages, SM messages and also SMS etc. As described herein, it couldalso be used to protect the user data.

Null-encryption is assumed to be needed in certain CIoT markets whereencryption is not allowed. This essentially means that the user planedata would be sent unprotected. This may cause significant increase tothe frequency of authentication, and in this way, it shortens theexpected lifetime of battery in CIoT UE.

GERAN has been analysing the Power Saving modes for MTC Devices, forexample in 3GPP TR 43.869 v13.0.0. The study focuses on specifying thePower Saving in the way that the energy consumption can be minimized,and consequently ten years of better lifetime for the CIoT UE can beguaranteed. The study assumes a limited use case, i.e. stationary CIoTUEs that are using the extended coverage offered by eGPRS but that arelimited in reachability and battery capacity. There are two modes ofoperation, the Network triggered traffic mode, and the Mobile autonomousreporting mode. Note, however, that these may not be the only trafficmodes that are relevant for EASE study. There may also be highly mobileCIoT UEs that have no battery limitations, that benefit from extendedcoverage and that require unlimited reachability.

In network triggered traffic mode, the CIoT UE is sending a report tothe network entity, typically only when triggered by the network to doso. This requires that the CIoT UE must be reachable as a result ofnetwork paging. There are two different phases in implementing thereachability. The first one is immediately after every report sendingperiod when it can be guaranteed that that the CIoT UE is reachable longenough to receive triggers from the network. The second one is formaking sure that the CIoT UE is reachable later within the sleepingmode, and wakes up periodically to see if there are new incoming pagingmessages. The longer the device can remain in the power saving state,the larger the power saving.

FIG. 5 illustrates the network triggered traffic mode. The figureassumes that the triggering packets are user plane data; however, theycould also be part of control plane. It can be seen from the figure thatthe CIoT UE and BSS exchange some unprotected signalling messages beforethe CIoT UE starts sending user plane data. According to all currentsolution proposals in 3GPP TR 33.860 v0.3.0, the user plane data canalso be sent unprotected if encryption is not used.

In mobile autonomous reporting mode, the CIoT UE is sending dataautonomously, e.g. in a periodic manner. The network may adjust theexact time for reporting in order to balance the network traffic load atspecific times. Reachability may still be possible via paging orimmediately after the reporting events but it is also possible that thereachability is not needed or used. In the most optimized case, thereare no periodical RAUs if the RAU Timer value is configured to be justbigger than the periodic UE wake-up/reporting time.

FIG. 6 illustrates the mobile autonomous reporting. It can be seen fromthe figure that the CIoT UE and BSS exchange some unprotected signallingmessages before the CIoT UE starts sending user plane data. Again,according to all current solution proposals in TR 33.860 v0.3.0, theuser plane data can also be sent unprotected if encryption is not used.

As described in more detail below, the integrity protection mechanismthat is currently being specified at LLC layer to protect the controlplane is re-used to protect the user plane. This solution describes howthe integrity protection of user data is negotiated between CIoT UE andSGSN.

In brief summary, in some embodiments, the CIoT UE may indicate theability of using integrity protection for user plane protection to thenetwork (e.g. SGSN) in e.g. the GMM Attach Request or GMM Routing AreaUpdate Request, together with other CIoT UE security capabilities. TheCIoT UE may also indicate the wish of using or not using integrityprotection of user data.

The SGSN may echo back the CIoT UE's security capabilities received inGMM Attach Request message or GMM Routing Area Update Request messageback to the CIoT UE in an integrity protected GMM message, so that theCIoT UE is able to check if the received CIoT UE's security capabilitiesmatches with the CIoT UE's security capability it sent in GMM AttachRequest message or GMM Routing Area Update Request message to the SGSN.In the existing solutions, CIoT UE's security capabilities includes thesupported integrity protect algorithms and the supported encryptionalgorithms in the CIoT UE. This invention would add the support ofspecified integrity protection algorithms for user plane protection too.If the UE's wish for using the integrity protection of user data wasalso added to the original GMM Attach Request or GMM Routing Area UpdateRequest from the CIoT UE to SGSN, this wish would also need to be echoedback from SGSN to CIoT UE, and integrity protected.

The solution includes some variants for also Home Subscriber Server(HSS) or Service Capability Exposure Function (SCEF) to indicate thewish of using integrity protection of user data to SGSN. The integrityprotection could be tied to the use of null-encryption, in which casethe use of user plane integrity protection would be an integral part ofthe use of null-encryption algorithm GEA0.

FIG. 7 illustrates a method in which integrity protection for user planedata is established, in the case of a 3G network.

As discussed in more detail below, it is the responsibility of the GMMlayer to start or activate integrity protection of user plane in the LLClayer. This applies to both CIoT UE and SGSN. The GMM layer in the CIoTUE should start or activate integrity protection of user plane in theLLC layer when a successful run of UMTS AKA on the USIM has taken place.

The GMM layer sends an indication to the LLC layer to handle this. Thisindication is internal to the CIoT UE and SGSN. This applies to bothCIoT UE and SGSN. The indication from the GMM layer to the LLC layer mayinclude the integrity key Kti_UP and the selected integrity algorithm.The integrity key for user plane Kti_UP may be different from theintegrity key for the control plane Kti_CP. The algorithm may be thesame as for the integrity protection of control plane, and could beindicated using a single parameter. This applies to both CIoT UE andSGSN.

The integrity algorithm negotiation procedure is described below,similar to cipher algorithm negotiation.

In this illustrated embodiment, integrity protection of user plane isactivated in LLC layer after CIoT UE has received the Attach Acceptmessage or Routing Area Update Accept from SGSN.

The illustrated embodiment includes four new parameters: (1) UPI_cap(user plane integrity protection capability): this is a parameter in MSnetwork capabilities indicating that the CIoT UE is capable of integrityprotecting the user plane. (2) UPI_wish_UE (wish of using user planeintegrity protection from UE side): this is an optional parameter thatthe UE may add to the Attach Request indicating that UE wish to use theintegrity protection of user plane. (3) UPI_wish_HN (wish of using userplane integrity protection from the Home Network side): this is anoptional parameter that the Home Network (e.g. HSS) may add to the AVsindicating that integrity protection of user plane should be used. (Notethat in another variant, this is not a wish but a mandatory command forturning the integrity protection on.). (4) UPI (user plane integrityprotection used): this is a parameter in Authentication and CipheringRequest indicating to the UE that user plane shall be integrityprotected; this parameter is added by SGSN.

Note that the mechanism described for integrity capability negotiationand integrity protection in FIG. 7 applies to other mobility managementprocedures as well as Routing Area Update procedure.

In step 701, the Cellular IoT UE sends attach request to SGSN. Thecipher algorithms and integrity algorithms supported by the Cellular IoTUE are included in the MS network capability parameters (not shown inthe Figure). The cellular IoT UE includes its IMSI, and the followingnew parameters: “UPI_cap: yes” indicating that the CIoT UE is capable ofprotecting the integrity of user plane, and, optionally, “UPI_wish_UE:yes” indicating that the CIoT UE is wishing to integrity protect theuser plane. “UPI_cap” is also optional if all UEs support this feature.

If the solution is integrated to 3GPP Service Capability ExposureFunction (SCEF) capabilities, the owner of the CIoT UE could configurethe use of integrity protection for the user data on/off using a Webinterface.

In step 702, the SGSN obtains AVs (quintets) from HLR/HSS based on IMSI.It may include a new optional parameter “UPI_wish_HN: yes” indicatingthat the Home Network wishes that the integrity of the user plane wasprotected between UE and SGSN.

The SGSN determines that the requesting UE is a cellular IoT UE based onthe MS network capability parameters. In step 703, the SGSN selects thecontrol plane protection mode: a cipher algorithm and an integrityalgorithm from the MS network capability and then derives cipher key(Ktc) and integrity key (Kti_CP) (not shown in FIG. 7). The SGSN alsodecides if the user plane shall be protected. This is a local decision,and can be based on several factors. For example, if SGSN does notsupport other encryption algorithms than null-encryption, it may want toprotect the integrity of user plane. Also, it may take the wishes fromthe UE or the HN indicated in “UPI_wish_UE” and “UPI_wish_HN” intoaccount, and decide to integrity protect the user plane. If SGSN decidesto integrity protect the user plane, it chooses the integrity algorithm(assumed to be the same as for the control plane integrity protection),and derives the integrity key (Kti_UP). It indicates the use ofintegrity protection for user plane by adding the “UPI: yes” parameter.Kti_UP is in minimum 128 bits long.

In step 704, the SGSN sends the Authentication and Ciphering Request tothe CIoT UE including 1) the chosen cipher algorithm and integrityalgorithm, 2) the indication of using integrity protection also for userplane (UPI: yes), 3) an echo of the MS network capabilities (includingthe new UPI_cap parameter) indicated to it by the UE, and 4), ifpresent, an echo of the optional parameter UPI_wish_UE. TheAuthentication and Ciphering Request message may be integrity protected.

In step 705, the Cellular IoT UE runs UMTS AKA with the USIM and derivesKtc, Kti_CP and Kti_UP from CK and IK. The Cellular IoT UE verifies theintegrity of the message, then the Cellular IoT UE checks the echoed MSnetwork capability and the optional UPI_wish_UE parameter. The CIoT UEverifies that there has been no attack on MS network capability orUPI_wish_UE originally sent by the Cellular IoT UE in the

GMM Attach Request. If the echoed parameters do not match those sent bythe CIoT UE, then the CIoT UE can conclude that a Man-in-the-middleattack has taken place on the air-interface and drops the connectionwith the network.

In step 706, the Cellular IoT UE sends an Authentication and CipheringResponse message including the RES to the SGSN.

The control plane between Cellular IoT UE and SGSN can now beconfidentiality protected and integrity protected by using Ktc andKti_CP. In step 707, the SGSN sends Attach Accept message to the CIoTUE.

In step 708, the GMM layer in the CIoT UE activates integrity protectionfor the user plane in the LLC layer by assigning the integrity keyKti_UP. The selected algorithm is the same as for the integrityprotection of control plane.

In step 709, the GMM layer in the SGSN activates integrity protectionfor the user plane in the LLC layer by assigning the integrity keyKti_UP. The selected algorithm is the same as for the integrityprotection of control plane.

As shown at 710, the CIoT UE and SGSN can now send integrity protecteduser plane.

As described above, the method can be used with 3GPP access networktechnologies such as 2G GPRS. However, a similar method could also beused in other 3GPP access network technologies as UTRAN and LTE. Itcould potentially be used also for end-to-middle security where thesecurity endpoint for the user plane security would be an entity in theHome Network.

FIG. 8 illustrates another embodiment, in which the negotiation of theuser plane integrity protection is done between the UE and an AccessSecurity Management Entity (ASME), and the user plane between the UE anda User Plane Protection Entity (UPPE) is integrity protected. Thisembodiment applies if the invention is used in 3G or LTE security wherethe role of UPPE is taken by the Node-B, RNC, or GGSN (in the case of3G) or by the P-GW, eNodeB or Serving Gateway (S-GW) (in the case ofLTE). UPPE may also be an entity in the Home Network, e.g. the HPLMNSecurity Endpoint (HSE) discussed in 3GPP TR 33.863, 14.0.0. The HSE maybe collocated with the GGSN/P-GW. This embodiment does not take a standon how the UE and UPPE agree on which integrity protection algorithm touse. It could be part of the security capability negotiation between UEand ASME (steps 801 and 804 in FIG. 8), or part of the data exchangebetween the UE and UPPE (step 807 in FIG. 8).

In step 801, the UE sends a request to ASME. The cipher algorithms andintegrity algorithms supported by the UE are included in the securitycapabilities parameter (not shown in FIG. 8). The UE includes its IMSI,and the following new parameters: “UPI_cap: yes” indicating that the UEis capable of protecting the integrity of user plane, and an optionalparameter “UPI_wish_UE: yes” indicating that the UE is wishing tointegrity protect the user plane. “UPI_cap” is also optional if all UEssupport this feature.

If the solution is integrated to 3GPP Service Exposure Function (SCEF)capabilities, the owner of the CIoT UE could configure the use ofintegrity protection for the user data on/off using a Web interface.

In step 802, the ASME may obtain AVs (quintets) from HLR/HSS based onIMSI (or it may have done this phase already earlier in the process).The response from HLR/HSS may include (or may have included) a newoptional parameter “UPI_wish_HN: yes” indicating that the Home Networkwishes that the integrity of the user plane was protected between UE andUPPE.

In step 803, the ASME decides if the user plane shall be protected. Thismay be a local decision, and can be based on several factors. Forexample, if ASME does not support other encryption algorithms thannull-encryption, it may want to protect the integrity of user plane.Also, it may take the wishes from the UE or the HN indicated in“UPI_wish_UE” and “UPI_wish_HN” into account, and decide to integrityprotect the user plane. If ASME decides to integrity protect the userplane, it derives the integrity key (Kti_UP). It indicates the use ofintegrity protection for user plane by adding the “UPI: yes” parameter.

In step 804, the ASME sends the Response to the UE including 1) theindication of using integrity protection also for user plane (UPI: yes),2) the security capabilities (including the new UPI_cap parameter) and3) the optional parameter UPI_wish_UE. The Response message is integrityprotected by means outside the scope of this invention.

In step 805, the UE verifies the integrity of the message, then the UEchecks the echoed security capabilities and the optional UPI_wish_UEparameter. The UE verifies that there has been no attack on securitycapabilities or the UPI_wish_UE originally sent by the UE in theRequest. The UE derives Kti_UP from CK and IK. If the echoed parametersdo not match those sent by the CIoT UE, then the CIoT UE can concludethat a Man-in-the-middle attack has taken place on the air-interface anddrops the connection with the network.

In step 806, the ASME forwards the integrity algorithm and the Kti_UP toUPPE.

As shown at step 807, the UE and UPPE may negotiate security parametersincluding which integrity algorithm to use. The integrity algorithm tobe used may also come from ASME but is not specified in this embodiment.

In step 808, the UE activates integrity protection for the user plane byassigning the integrity key Kti_UP and the integrity protectionalgorithm.

In step 809, the UPPE activates integrity protection for the user planeby assigning the integrity key Kti_UP and the integrity protectionalgorithm.

As shown at 810, the UE and UPPE can now send integrity protected userplane.

In another variant, it is not optional for the SGSN/ASME to follow thewish of the HLR/HSS. If the HLR/HSS indicates that user plane shall beprotected (UPI_wish_HN: yes), the SGSN/ASME is mandated to enableintegrity protection of user plane. There could be some additionalconditions that would need to be met, e.g. if no encryption was usedbetween the UE and the SGSN/ASME, fulfilling the HLR/HSS wish would bemandatory.

In another variant, none of the new UPI parameters are needed. Theintegrity protection of user data is tied directly to thenull-encryption algorithm GEA0. Whenever GEA0 is used, the integrityprotection of user data is always turned on.

FIG. 9 illustrates functional units in a terminal device which mayexecute any of the methods described above, for example according tocomputer readable instructions received from a computer program. It willbe understood that the units illustrated in FIG. 9 are softwareimplemented functional units, and may be realised in any appropriatecombination of software modules.

Specifically, the terminal device 900A comprises an activation means902A for activating integrity protection for user plane data transferredbetween the terminal device and a network node of the cellularcommunications network. The terminal device 900A may also comprise asending means 904A for sending messages to the network node as describedabove. The terminal device 900A may also comprise a receiving means 906Afor receiving messages from the network node as described above.

FIG. 10 illustrates functional units in a network node for a cellularcommunications network which may execute any of the methods describedabove, for example according to computer readable instructions receivedfrom a computer program. It will be understood that the unitsillustrated in FIG. 10 are software implemented functional units, andmay be realised in any appropriate combination of software modules.

Specifically, the network node 920A comprises an activation means 922Afor activating integrity protection for user plane data transferredbetween a terminal device and the network node. The network node 920Amay also comprise a sending means 924A for sending messages to thenetwork node as described above. The terminal device 920A may alsocomprise a receiving means 926A for receiving messages from the networknode as described above.

FIG. 11 illustrates functional units in another embodiment of terminaldevice which may execute any of the methods described herein, forexample according to computer readable instructions received from acomputer program. It will be understood that the units illustrated inFIG. 11 are hardware implemented functional units, and may be realisedin any appropriate combination of hardware elements.

Specifically, the terminal device 900B comprises an activation unit 902Bfor activating integrity protection for user plane data transferredbetween the terminal device and a network node of the cellularcommunications network. The terminal device 900B may also comprise asending unit 904B for sending messages to the network node as describedabove. The terminal device 900B may also comprise a receiving unit 906Bfor receiving messages from the network node as described above.

FIG. 12 illustrates functional units in another embodiment of networknode for a cellular communications network which may execute any of themethods described herein, for example according to computer readableinstructions received from a computer program. It will be understoodthat the units illustrated in FIG. 12 are hardware implementedfunctional units, and may be realised in any appropriate combination ofhardware elements according to embodiments.

Specifically, the network node 920B comprises an activation unit 922Bfor activating integrity protection for user plane data transferredbetween a terminal device and the network node. The network node 920Bmay also comprise a sending unit 924B for sending messages to thenetwork node as described above. The terminal device 920B may alsocomprise a receiving unit 926B for receiving messages from the networknode as described above.

FIG. 13 is a flow chart, illustrating a method of operation of aterminal device in a cellular communications network. The methodcomprises, as an optional first step 1301, sending a request messagefrom the terminal device to a second network node, wherein the requestmessage also indicates the ability of the terminal device to useintegrity protection for user plane data. The method then comprises, asstep 1302, activating integrity protection for user plane datatransferred between the terminal device and a first network node of thecellular communications network.

The terminal device may comprise an activation module, for activatingintegrity protection for user plane data transferred between theterminal device and a first network node of the cellular communicationsnetwork.

FIG. 14 is a flow chart, illustrating a method of operation of a networknode in a cellular communications network. The method comprises, as anoptional first step 1401, receiving a request message from a terminaldevice of the cellular communications network, wherein the requestmessage also indicates the ability of the terminal device to useintegrity protection for user plane data. The method then comprises, asstep 1402, activating integrity protection for user plane datatransferred between the network node and the terminal device.

The network node may comprise an activation module, for activatingintegrity protection for user plane data transferred between the networknode and a terminal device.

FIG. 15 is a flow chart, illustrating a method of operation of a firstnetwork node in a cellular communications network. The method comprises,as an optional first step 1501, receiving a message from a secondnetwork node, said message specifying that integrity protection is to beused for user plane data. The method then comprises, as step 1502,activating integrity protection for the user plane data transferredbetween the first network node and a terminal device of the cellularcommunications network.

The first network node may comprise an activation module, for activatingintegrity protection for user plane data transferred between the firstnetwork node and a terminal device of the cellular communicationsnetwork.

FIG. 16 is a flow chart, illustrating a method of operation of a secondnetwork node in a cellular communications network. The method comprises,as an optional first step 1601, receiving a request message from aterminal device of the cellular communications network, wherein therequest message also indicates the ability of the terminal device to useintegrity protection for user plane data. The method then comprisesactivating integrity protection for user plane data transferred betweena first network node and the terminal device.

The second network node may comprise an activation module for activatingintegrity protection for user plane data transferred between a firstnetwork node and a terminal device.

There are thus described methods of operation of a terminal device and anetwork node that allow for integrity protection, as well as a terminaldevice itself and a network node itself.

It should be noted that the above-mentioned embodiments illustraterather than limit the invention, and that those skilled in the art willbe able to design many alternative embodiments without departing fromthe scope of the appended claims. The word “comprising” does not excludethe presence of elements or steps other than those listed in a claim,“a” or “an” does not exclude a plurality, and a single feature or otherunit may fulfil the functions of several units recited in the claims.Any reference signs in the claims shall not be construed so as to limittheir scope.

1-26. (canceled)
 27. A method of operation of a terminal device in acellular communications network, the method comprising: transmitting arequest message to a network node; receiving from the network node aresponse message responsive to the request message, the response messagecomprising information indicating that integrity protection is to beused for user plane data transferred between the network node and theterminal device and information indicating a selected integrityalgorithm; and activating integrity protection for user plane datatransferred between the terminal device and the network node of thecellular communications network using the selected integrity algorithm.28. The method of claim 27, wherein the request message indicates theability of the terminal device to use integrity protection for userplane data.
 29. The method of claim 28, wherein the request message alsospecifies at least one algorithm that the terminal device is capable ofusing for integrity protection of user plane data.
 30. The method ofclaim 28, wherein the terminal device perform the activating step inresponse to receiving the response message.
 31. The method of claim 27,further comprising activating integrity protection for the user planedata in a Logical Link Control layer in response to an activationmessage from a GPRS Mobility Management layer; and deriving an integritykey to be used by running UMTS AKA on the USIM.
 32. The method of claim27, further comprising using null encryption for the user plane data.33. A computer program product comprising a non-transitory computerreadable storage medium storing a computer program, wherein the computerprogram is configured, when run on a computer, to cause the computer tocarry out the method of claim
 27. 34. A method of operation of a networknode in a cellular communications network, the method comprising:receiving a request message from a terminal device; in response toreceiving the request message, determining whether to use integrityprotection for user plane data transferred between the network node andthe terminal device; selecting an integrity algorithm; informing theterminal device that integrity protection is used for user plane dataand of the selected integrity algorithm; and activating integrityprotection for user plane data transferred between the network node andthe terminal device.
 35. The method of claim 34, wherein the requestmessage indicates the ability of the terminal device to use integrityprotection for user plane data.
 36. The method of claim 35, wherein therequest message also specifies at least one algorithm that the terminaldevice is capable of using for integrity protection of user plane data.37. The method of claim 35, further comprising activating integrityprotection for the user plane data after sending a return message to theterminal device, the return message specifying that integrity protectionis to be used for the user plane data.
 38. The method of claim 34,further comprising deriving an integrity key to be used.
 39. A computerprogram product comprising a non-transitory computer readable storagemedium storing a computer program, wherein the computer program isconfigured, when run on a computer, to cause the computer to carry outthe method of claim
 34. 40. A terminal device, the terminal devicecomprising: a receiver for receiving from a network node a response to arequest, the response comprising information indicating that integrityprotection is to be used for user plane data transferred between thenetwork node and the terminal device and information indicating aselected integrity algorithm; and a processor configured to derive anintegrity key, wherein the terminal device is configured to activateintegrity protection for user plane data transferred between theterminal device and the network node using the selected integrityalgorithm.
 41. The terminal device of claim 40, wherein the requestmessage indicates the ability of the terminal device to use integrityprotection for user plane data.
 42. The method of claim 41, wherein therequest message also specifies at least one algorithm that the terminaldevice is capable of using for integrity protection of user plane data.43. A network node for use in a cellular communications network, thenetwork node comprising: a receiver for receiving a request messagetransmitted by a terminal device; and a processor for determiningwhether to use integrity protection for user plane data transferredbetween the network node and the terminal device, wherein the networknode is configured such that, if it is determined that integrityprotection is to be used for user plane data transferred between thenetwork node and the terminal device, the network node: selects anintegrity algorithm; informs the terminal device that integrityprotection is used for user plane data and of the selected integrityalgorithm; and activates integrity protection for user plane datatransferred between the network node and the terminal device.
 44. Theterminal device of claim 43, wherein the request message indicates theability of the terminal device to use integrity protection for userplane data.
 45. The method of claim 44, wherein the request message alsospecifies at least one algorithm that the terminal device is capable ofusing for integrity protection of user plane data.